Linux kernel iomap: length underflow on non-block-aligned reads returns a position past the folio

Impact

iomap_adjust_read_range() assumed the position and length handed to it were block-aligned; when they are not, it skips too many bytes for uptodate blocks and, if all blocks are uptodate, underflows the length and returns a position beyond the folio. iomap is the shared read path under XFS, ext4 and erofs, so this is core filesystem code on ordinary datacenter nodes rather than a niche driver. The reported trigger is a syzbot case on erofs, meaning practical exposure is a local actor who can get the kernel to read from an attacker-shaped filesystem - a crafted image, a loopback or automounted volume - not a remote request. NVD's 9.8 network vector is not supported by anything in the description; read this as a local memory-safety bug whose reachability depends on whether your nodes ever mount untrusted images.

Who can reach it

Local. Someone who can cause reads against an attacker-influenced filesystem, most concretely a user or container permitted to mount an image (CAP_SYS_ADMIN in a user namespace, loopback mounts, automount of removable media). Nodes that only mount operator-controlled XFS/ext4 volumes are far harder to reach.

What to do

Pick up a stable kernel containing the fix (the linked git.kernel.org commits) and reboot the node; it is a core filesystem read path, so plan it as a normal kernel update with a drain and reboot rather than a hot-patch. In the meantime, denying unprivileged and container-initiated mounts of untrusted filesystem images removes the documented trigger.

References

Related entries

• Linux kernel (net/tls): Closing a kTLS socket cancelled the transmit work item, but the write-space callback couldCVE-2026-23240 · Linux kernel (net/tls)Critical
• Linux kernel (net/smc): An inbound SYN handled in softirq reads the smc_sock out of the listening TCP socket'sCVE-2026-23450 · Linux kernel (net/smc)Critical
• Linux kernel (net/tls): When the crypto engine backlogs a kTLS encrypt request, both the async completion callback andCVE-2026-31533 · Linux kernel (net/tls)Critical
• Linux kernel (net/ipv4): A child socket created from an inbound handshake is inserted into the TCP hash table beforeCVE-2026-43198 · Linux kernel (net/ipv4)Critical
• Linux kernel mlx5_core RX datapath (striding RQ, page_pool): A regression introduced by the fix for CVE-2025-40350CVE-2026-43465 · Linux kernel mlx5_core RX datapath (striding RQ, page_pool)Critical
• Linux kernel nvmet-tcp - ICReq/teardown race and data-digest error paths: Three lifecycle bugs an initiator can driveCVE-2026-46135 · Linux kernel nvmet-tcp - ICReq/teardown race and data-digest error pathsCritical